CVE-2026-44938

published 2026-07-07

CVE-2026-44938: A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or…

Priority P2 58 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace.

An attacker with git push access to a
Fleet-monitored repository could overwrite Pod Security Standards (PSS)
enforcement labels on a target namespace. This allows the attacker to
weaken admission controls and deploy workloads that PSS policies would
otherwise block.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
github.com	rancher_fleet	>= 0.12.0 < 0.12.15	0.12.15
github.com	rancher_fleet	>= 0.13.0 < 0.13.11	0.13.11
github.com	rancher_fleet	>= 0.14.0 < 0.14.6	0.14.6
github.com	rancher_fleet	>= 0.15.0 < 0.15.2	0.15.2
suse	rancher	>= 0.12.0 < 0.12.15	0.12.15
suse	rancher	>= 0.13.0 < 0.13.11	0.13.11
suse	rancher	>= 0.14.0 < 0.14.6	0.14.6
suse	rancher	>= 0.15.0 < 0.15.2	0.15.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-522